Firefox extension network steals wallet recovery phrases, credentials and clipboard data
Socket found 77 linked Firefox add-ons; 40 were confirmed wallet stealers. Some began harmless and turned malicious via updates. 16 more followed in October. If you entered a recovery phrase in one, move funds to a new wallet. Remove unfamiliar wallet extensions.
If you installed a wallet or utility add-on in Firefox that you don't recognise, remove it. If you ever typed a recovery phrase or private key into one, move your funds to a new wallet with a new phrase, created on a clean device.
What’s happening
In August 2026 security firm Socket reported a network of 77 linked Firefox extension identities, active since at least March. Forty were confirmed malicious and 37 were sports-score extensions with no confirmed theft code, which Socket regards as likely precursors. The malicious ones impersonated crypto wallets, some using modified Rabby Wallet code, and captured recovery phrases, private keys, wallet keyrings, credentials or clipboard contents. Nine began as sports-score extensions and became stealers through updates. Mozilla removed one extension, 0KX WEB3, before publication; Socket's report does not say whether every one was removed. In October, Socket reported 16 more extensions on the same infrastructure, and press reports say Mozilla had unpublished them by 5 October. Socket gave no victim count or loss total, and attribution is unresolved. Removing an extension stops further theft but does not undo a secret already sent: affected wallets should be treated as permanently compromised.
- What
- Poisoned software
- Affects
- Mozilla Firefox add-ons (crypto wallet and utility extensions)
- Affected
- Malicious Firefox extensions including 0KX WEB3, Portal, Portal Web, Crypto & EVM, Rabbit For Desktop, RABB-WALLET variants, exrb, trl (TrooonLink, TrLink); 37 sports-score shell extensions; 16 further extensions reported in October (including 'Portal WALLET')
- Fixed in
- No fix yet
- Since
- 19 Aug 2026
Timeline
- Wider attacks
Socket reported 16 more malicious Firefox extensions (four built from Rabby Wallet code, twelve styled on OKX Wallet and sold as 'Portal WALLET') using the same infrastructure as the August campaign. Press reports say Mozilla had unpublished all 16 by 5 October.
- Update
Socket said it now scans every extension in Mozilla's add-ons directory (97,100 Firefox-compatible listings at the time). It said nine malicious identities began as sports-score shells and turned into wallet stealers, and that a harmless extension can become malicious in a later automatic update.
- Made publicPartly fixed
Socket Threat Research reported 77 linked Firefox extension identities active since at least March 2026: 40 confirmed malicious and 37 sports-score shells. The malicious ones captured recovery phrases, private keys, wallet keyrings, credentials or clipboard contents. Mozilla removed the 0KX WEB3 extension before publication.
Sources
- 77 Firefox Extensions Linked to Crypto Wallet and Credential TheftSocket · 19 Aug 2026
- Socket Firefox extension security coverageSocket · 20 Aug 2026
- 16 malicious Firefox extensions caught stealing crypto wallet secretsCyberInsider · 7 Oct 2026
- 40 malicious Firefox extensions caught stealing crypto wallet dataCyberInsider · 19 Aug 2026